Technical impact
The vulnerability is an OS command injection flaw in Schneider Electric PowerLogic™ P7’s network‑exposed service. It allows an attacker who has gained privileged authenticated access to inject arbitrary and potential compromise of system integrity, confidentiality, and availability.
Affected Systems
Schneider Electric PowerLogic™ P7 devices are affected. No specific firmware or serial versions are listed in the vendor data.
Risk and Exploitability
The CVSS score of 8.6 indicates high severity. The EPSS score of 1% shows a low but non‑zero exploitation probability, reflecting that the flaw is considered unlikely to be widely exploited yet. The flaw is not listed in CISA KEV, suggesting no publicly known, active exploitation at this time. The attack vector requires a privileged authenticated user to interact with the vulnerable service, implying that an attacker must already have some level of authorized access before exploiting the command injection. If successful, the exploited commands would run with the privileges of the authenticated user, enabling broader system compromise.
